AVARE: Aggregated vulnerability assessment and response against zero-day exploits

In this paper we propose an automated approach for determining recently published vulnerabilities pertinent to the current network/system configuration using the information aggregated from different bug tracking communities. Such vulnerability assessment and indication mechanisms significantly alleviate the system administrator's burden of manual content digging for vulnerabilities in his/her own configuration context. Furthermore, we propose an Extensible Defense Oriented Representation Schema (EDORS) for vulnerability representation, which is consequently used by the policy engine to generate appropriate IDS signatures. As a result, the generated signatures can be viewed as a preventive stop-gap security measure against zero-day exploits until its patch is released. In the absence of precise detection signatures, we extend our framework to perform forensic analysis on the alerts generated, by constructing Bayesian causality graphs to assess the impact and extent of the attack. The preliminary experiments carried out suggest that our approach is able to analyze the system/network for even the most recent zero-day vulnerabilities and generate their corresponding signatures with very minimal performance and administrative overhead.